romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 23:17:19 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: fix potential OOB read in debug/verbose logging

Browse source 
Reported-by: aisle-research-bot
Bug: https://github.com/curl/curl/pull/20654#discussion_r2834860711

Closes #20656
This commit is contained in:
Viktor Szakats 2026-02-20 21:41:40 +01:00
parent 020f48d00c
commit b35e58b24c
No known key found for this signature in database
1 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/vtls/openssl.c
View file

@ -2564,9 +2564,11 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
&& content_type != SSL3_RT_INNER_CONTENT_TYPE
#endif
) {
const char *msg_name, *tls_rt_name;
const char *msg_name = "Truncated message";
const char *tls_rt_name;
char ssl_buf[1024];
int msg_type, txt_len;
int msg_type = 0;
int txt_len;
/* the info given when the version is zero is not that useful for us */
@ -2582,14 +2584,18 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
tls_rt_name = "";
if(content_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
msg_type = *(const char *)buf;
msg_name = "Change cipher spec";
if(len) {
msg_type = *(const char *)buf;
msg_name = "Change cipher spec";
}
}
else if(content_type == SSL3_RT_ALERT) {
msg_type = (((const char *)buf)[0] << 8) + ((const char *)buf)[1];
msg_name = SSL_alert_desc_string_long(msg_type);
if(len >= 2) {
msg_type = (((const char *)buf)[0] << 8) + ((const char *)buf)[1];
msg_name = SSL_alert_desc_string_long(msg_type);
}
}
else {
else if(len) {
msg_type = *(const char *)buf;
msg_name = ssl_msg_type(ssl_ver, msg_type);
}